Flare solution 3.1.0 #3
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ireydiak
force-pushed
the
ireydiak-flare/flare-solution-cff-connector
branch
2 times, most recently
from
a5fc45e to
cc32b42
Compare
- replaced Rest API collector with CCF collector - new Table definition - new DCR for CFF collector - new Polling configuration for CFF collector
ireydiak
force-pushed
the
ireydiak-flare/flare-solution-cff-connector
branch
from
cc32b42 to
ab7bb41
Compare
xvaier
reviewed
Dec 17, 2025
xvaier
left a comment
xvaier
left a comment
There was a problem hiding this comment.
A good idea would be to have Mike try to install it to see if it's easy to do.
|
|
||
| | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | | ||
| | ----------- | ------------------------------ | ------------------------------------------------------------------------- | | ||
| | 3.1.0 | 15-12-2024 | New CFF connector that replaces deprecated Rest API connector. | |
| "content": { | ||
| "version": "KqlItem/1.0", | ||
| "query": "Firework_CL\n| make-series num=count() on timestamp_t from ago(30d) to now() step 8h by strcat(\"Risk Score \", tostring(toint(risk_score_d)))\n| render timechart ", | ||
| "query": "FireworkV2_CL\n| make-series num=count() on timestamp_t from ago(30d) to now() step 8h by strcat(\"Risk Score \", tostring(toint(risk_score_d)))\n| render timechart ", |
There was a problem hiding this comment.
I think we could rename this Flare_CL.
Firework used to be the public facing name for the Flare frontend, but it's not used that much anymore externally.
There was a problem hiding this comment.
I assume this is a generated file from the other ones?
| | where source_s contains "Grayhat_warfare" and (risk_score_d == "3" or risk_score_d == "4" or risk_score_d == "5") | ||
| version: 1.0.1 | ||
| kind: Scheduled | ||
| version: 2.0.0 |
There was a problem hiding this comment.
Is the versioning of the analytics rules separate from the package version?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Change(s):
FireworkV2_CL.Firework_CLtable;FireworkV2_CLshould be used instead.FireworkV2_CL.FireworkV2_CL.Reason for Change(s):
Version Updated:
Testing Completed:
Checked that the validations are passing and have addressed any issues that are present: